# CVE-2026-109163: Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/661) · 2026-11-11 · Security
Page: https://themorning.dev/story/cve-2026-109163-apache-http-server-mod-vhost-alias-1-byte-stack-buffer-overwrite-10b1fda134582304
Kind: security · Impact: low

## In brief

- CVE-2026-109163 is a stack-based buffer overflow in Apache HTTP Server's mod_vhost_alias module, described as a 1-byte stack buffer overwrite.
- The issue affects Apache HTTP Server 2.4.69 through 2.4.70, according to the oss-sec post.
- The disclosure is listed as low severity and follows CVE-2026-63292, a related mod_vhost_alias issue.

## Why it matters

Servers running affected Apache HTTP Server versions with mod_vhost_alias enabled may be exposed to a memory corruption bug, so operators should check whether the module is in use.

## What to do

- Check whether Apache HTTP Server 2.4.69 or 2.4.70 is deployed and whether mod_vhost_alias is loaded

## Versions

- Apache HTTP Server 2.4.69
- Apache HTTP Server 2.4.70

## CVEs

- CVE-2026-109163

## Timeline

- 2026-11-11: Vulnerability disclosed on oss-sec by Eric Covener

## Coverage

- [CVE-2026-109163: Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)](https://seclists.org/oss-sec/2026/q4/661) — Open Source Security, 2026-11-11

Tags: apache, security, vulnerability, http-server, mod_vhost_alias, memory-safety

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev